Emerson Exchange 365

The short answer is no. CHARMS form the interface point between a single field device and the CSLS redundant communication bus. Although each CHARM has some redundant components (Communication transceivers, Power distribution, enhanced diagnostics) the electrical circuit that connects the field signal is simplex.

The question that I think is important is why would you install redundant components. In traditional IO cards, where 8, 16 or even 32 channels are dependent on the common sensing circuitry, critical signals need to be routed such that a failure of that card is mitigated. Or you install a redundant card, giving you increased availability due to card failure. It is never 100% because there is some level of common hardware between the wiring terminal and the two cards, such as a relay. The other benefit of the redundant card is you are no longer as concerned about segregating critical signals to mitigate card failure. You've done that with the redundant card.

But now that you have addressed the single point of failure of the multi channel card, where are you on the availability of the System. By system, I include the instrumentation. After all, without the initiator in the field to detect the unsafe process condition, your SIF is either incapacitated or you are shutdown.

THe CHARMS architecture takes the approach that the CHARM is part of the field wiring. One instrument connects to the CSLS via a single CHARM. Failure of the CHARM or the instrument or any of the intermediary hardware has the same result. Loss of that one field signal. The CSLS is redundant, as is the CHARM bus and power distribution.

SO the reason we add redundancy is to increase system availability. We define our required availability for the system. For CHARMS we take the approach that no single failure will affect more than one field signals. A CHARM failure delivers that.

In reality, we are concerned with availability of the Process. An SIS with no instrumentation is not functional. A SIF with a failed Transmitter is degraded or tripped. Adding redundancy to the LS AI CHARM will not elevate the availability of the attached instrument. It would add cost and complexity to the CHARM design and actually double the CHARM footprint. A complete availability calculation including the instruments would be virtually identical.

If there is concern about the loss of a signal and how that impacts the safety or availability of the process, the right answer (in my opinion) is to add a second sensor/transmitter. That will significantly improve the availability of the process and avoid a spurious trip due to sensor failure, and CHARM failure.

A look at the CHARM design and its MTBFR or PFD numbers will show that the availability of the signal is dependent on the transmitter, which is installed in the process, subject to a much more challenging environment.

Remember that in the design of your safety system, and BPCS for that matter, you have to consider how the system reacts to loss of signal from an instrument. The availability numbers of that instrument are the best it can get. The CHARM numbers are significantly higher, and maybe orders of magnitude higher, making a redundant CHARM moot. Your risk is in the transmitter, which you will mitigate by adding a second transmitter, which adds a second CHARM.

Of course if you ignore the instrumentation and evaluate only the SIS, and wish to state your system availability as no failure will result in the loss of any signal, you can argue yourself into believing you need redundant CHARMS. But as soon as you include instrumentation in to the calculation you will have the same availability because the instruments are the single points of failure that have the highest probability of failure on demand.

Andre Dicaire